Research
Is security a skill issue? Five scanners, 3,084 skills, a different verdict 64% of the time · Mastro
Publication date not yet evaluated · Added trymastro.com
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Defenders relying on skill-marketplace scanners and 'green check' badges may be trusting tools that cannot consistently distinguish safe from malicious agent skills, leaving credential-exfiltrating supply-chain attacks undetected.
A Mastro study analyzed 3,084 agent skills across five security scanners and found they disagree on a verdict 63.9% of the time, with 14.2% rated CRITICAL by one scanner and SAFE by another. The piece frames the broader supply-chain risk of AI agent skills—markdown files agents execute with full tool access—citing reported incidents where malicious skills lifted SSH keys, cloud credentials, and crypto wallets, and a fake download counter pushed a dummy skill to #1.